CVE-2021-29089: SQL Injection in Synology Photo Station

The SQL Injection vulnerability in Synology Photo Station poses a significant threat. An attacker could leverage this flaw to bypass authentication mechanisms and directly manipulate the database. This could result in the unauthorized extraction of sensitive user data, including usernames, passwords, and stored media files. Furthermore, successful exploitation could allow an attacker to gain control of the Photo Station server, potentially leading to broader network compromise and lateral movement within the organization. The impact is particularly severe given the potential for data exfiltration and system takeover.

1. Reserved2021-03-23
2. Published2021-06-02
3. Modified2024-09-16
4. EPSS updated2026-04-02

The primary mitigation for CVE-2021-29089 is to upgrade Synology Photo Station to version 6.8.14-3500 or later. If immediate upgrade is not possible due to compatibility issues or downtime constraints, consider implementing temporary workarounds. While a direct WAF rule targeting SQL Injection attempts is recommended, the complexity of the vulnerability may require a more sophisticated rule set. Monitor Photo Station logs for unusual SQL queries or database activity. After upgrading, confirm the fix by attempting a SQL Injection payload through the thumbnail component and verifying that it is properly sanitized.